Skip to content

Add UnitTest to verify updateTrustCredentials rotate #11798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jan 9, 2025
Merged

Add UnitTest to verify updateTrustCredentials rotate #11798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b38a733
Add UnitTest to verify updateTrustCredentials rotate
AlbumenJ Jan 5, 2025
b762db6
Fix jdk8
AlbumenJ Jan 5, 2025
405044d
Fix style
AlbumenJ Jan 5, 2025
9940ea7
Replace with Guava File
AlbumenJ Jan 9, 2025
b098d7c
Add lastUpdateTime to avoid read
AlbumenJ Jan 9, 2025
74d65d1
Enhance test
AlbumenJ Jan 9, 2025
a56e7f1
Fix import
AlbumenJ Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@ public Closeable updateTrustCredentials(File trustCertFile, long period, TimeUni
}
final ScheduledFuture<?> future =
checkNotNull(executor, "executor").scheduleWithFixedDelay(
new LoadFilePathExecution(trustCertFile), period, period, unit);
new LoadFilePathExecution(trustCertFile, updatedTime), period, period, unit);
return () -> future.cancel(false);
}

Expand Down Expand Up @@ -312,9 +312,9 @@ private class LoadFilePathExecution implements Runnable {
File file;
long currentTime;

public LoadFilePathExecution(File file) {
public LoadFilePathExecution(File file, long currentTime) {
this.file = file;
this.currentTime = 0;
this.currentTime = currentTime;
}

@Override
Expand Down
43 changes: 42 additions & 1 deletion util/src/test/java/io/grpc/util/AdvancedTlsX509TrustManagerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
import static org.mockito.Mockito.when;

import com.google.common.collect.Iterables;
import com.google.common.io.Files;
import io.grpc.internal.FakeClock;
import io.grpc.internal.testing.TestUtils;
import io.grpc.testing.TlsTesting;
Expand Down Expand Up @@ -57,21 +58,28 @@ public class AdvancedTlsX509TrustManagerTest {

private static final String CA_PEM_FILE = "ca.pem";
private static final String SERVER_0_PEM_FILE = "server0.pem";
private static final String SERVER_1_PEM_FILE = "server1.pem";
private File caCertFile;
private File serverCert0File;
private File serverCert1File;

private X509Certificate[] caCert;
private X509Certificate[] serverCert0;
private X509Certificate[] serverCert1;

private FakeClock fakeClock;
private ScheduledExecutorService executor;

@Before
public void setUp() throws IOException, GeneralSecurityException {
executor = new FakeClock().getScheduledExecutorService();
fakeClock = new FakeClock();
executor = fakeClock.getScheduledExecutorService();
caCertFile = TestUtils.loadCert(CA_PEM_FILE);
caCert = CertificateUtils.getX509Certificates(TlsTesting.loadCert(CA_PEM_FILE));
serverCert0File = TestUtils.loadCert(SERVER_0_PEM_FILE);
serverCert0 = CertificateUtils.getX509Certificates(TlsTesting.loadCert(SERVER_0_PEM_FILE));
serverCert1File = TestUtils.loadCert(SERVER_1_PEM_FILE);
serverCert1 = CertificateUtils.getX509Certificates(TlsTesting.loadCert(SERVER_1_PEM_FILE));
}

@Test
Expand Down Expand Up @@ -147,6 +155,39 @@ public void clientTrustedWithSocketTest() throws Exception {
assertEquals("No handshake session", ce.getMessage());
}

@Test
public void updateTrustCredentials_rotate() throws GeneralSecurityException, IOException {
AdvancedTlsX509TrustManager trustManager = AdvancedTlsX509TrustManager.newBuilder().build();
trustManager.updateTrustCredentials(serverCert0File);
assertArrayEquals(serverCert0, trustManager.getAcceptedIssuers());

trustManager.updateTrustCredentials(serverCert0File, 1, TimeUnit.MINUTES,
executor);
assertArrayEquals(serverCert0, trustManager.getAcceptedIssuers());

fakeClock.forwardTime(1, TimeUnit.MINUTES);
assertArrayEquals(serverCert0, trustManager.getAcceptedIssuers());

serverCert0File.setLastModified(serverCert0File.lastModified() - 10);

fakeClock.forwardTime(1, TimeUnit.MINUTES);
assertArrayEquals(serverCert0, trustManager.getAcceptedIssuers());

long beforeModify = serverCert0File.lastModified();
Files.copy(serverCert1File, serverCert0File);
serverCert0File.setLastModified(beforeModify);

// although file content changed, file modification time is not changed
fakeClock.forwardTime(1, TimeUnit.MINUTES);
assertArrayEquals(serverCert0, trustManager.getAcceptedIssuers());

serverCert0File.setLastModified(beforeModify + 10);

// file modification time changed
fakeClock.forwardTime(1, TimeUnit.MINUTES);
assertArrayEquals(serverCert1, trustManager.getAcceptedIssuers());
}

private static class TestHandler extends Handler {
private final List<LogRecord> records = new ArrayList<>();

Expand Down
Loading